Modal logo
CLI Reference modal app modal billing modal changelog modal config modal container modal curl modal dashboard modal deploy modal dict modal endpoint modal environment modal function modal image modal profile modal queue modal run modal secret modal serve modal server modal setup modal shell modal skills modal token modal volume modal workspace

modal workspace

Interact with the current Modal Workspace.

A Workspace is the top-level account that owns your Modal resources. Use these commands to manage workspace-level settings such as proxy tokens.

Usage:

modal workspace [OPTIONS] COMMAND [ARGS]...

Options:

  • --help: Show this message and exit.

Commands:

  • member-tokens: Manage Member API Tokens.
  • members: View the members of the current Workspace.
  • proxy-tokens: Manage the proxy tokens of the current Workspace.
  • service-users: Manage Service Users.
  • settings: Manage workspace settings.

Manage Member API Tokens.

All Member Tokens are associated with a unique Member of the Workspace. Any requests to Modal using a Token are authenticated as the associated Member (and as such, are governed by the permissions that have been assigned to the specific Member). Workspace Owners and Managers can use modal environment roles update to update these permissions programmatically.

This CLI allows users to list and delete the tokens associated to themselves. Workspace Owners and Managers can list all tokens in their Workspace, and can delete any of them.

Usage:

modal workspace member-tokens [OPTIONS] COMMAND [ARGS]...

Options:

  • --help: Show this message and exit.

Commands:

  • delete: Delete a Member Token in this Workspace.
  • disable: Disable member tokens in this Workspace.
  • enable: Enable member tokens in this Workspace.
  • list: List Member Tokens in the Workspace.

Delete a Member Token in this Workspace.

Note that this action is irreversible. This will immediately invalidate the target token and will render it unable to authenticate with Modal.

# Delete the Token with ID `ak-0123456789abcdefghijkl`
modal workspace member-tokens delete ak-0123456789abcdefghijkl

Usage:

modal workspace member-tokens delete [OPTIONS] TOKEN_ID

Options:

  • --allow-missing: Don't error if the Token doesn't exist.
  • -y, --yes: Run without pausing for confirmation.
  • --help: Show this message and exit.

Disable member tokens in this Workspace.

A token which is disabled cannot be used to authenticate with Modal. However, it can be re-enabled at any point using modal workspace member-tokens enable.

You can pass the --all option to disable all of the tokens you have created. If you are a Manager or above, this will disable all the tokens in your Workspace.

Examples:

modal workspace member-tokens disable ak-0123456789abcdefghijkl

# Disable multiple tokens simultaneously
modal workspace member-tokens disable ak-0123456789abcdefghijkl ak-mnopqrstuvwxyz01234567

# Disable everything you have access to
modal workspace member-tokens disable --all

See Also: - modal workspace member-tokens enable - Workspace.member_tokens.disable(). The SDK equivalent of this command.

Usage:

modal workspace member-tokens disable [OPTIONS] [TOKEN_IDS]...

Options:

  • --all: Disable all tokens you have access to.
  • -y, --yes: Run without pausing for confirmation.
  • --help: Show this message and exit.

Enable member tokens in this Workspace.

This is the opposite operation to disabling a token - given a disabled token, this command will re-enable it, allowing it to authenticate with Modal.

Examples:

modal workspace member-tokens enable ak-0123456789abcdefghijkl

# Enable multiple tokens simultaneously
modal workspace member-tokens enable ak-0123456789abcdefghijkl ak-mnopqrstuvwxyz01234567

See Also: - modal workspace member-tokens disable - Workspace.member_tokens.enable(): The SDK equivalent of this command.

Usage:

modal workspace member-tokens enable [OPTIONS] [TOKEN_IDS]...

Options:

  • -y, --yes: Run without pausing for confirmation.
  • --help: Show this message and exit.

List Member Tokens in the Workspace. Workspace Managers and Owners can see all tokens in the Workspace.

modal workspace member-tokens list

# Show list in JSON format:
modal workspace member-tokens list --json

Usage:

modal workspace member-tokens list [OPTIONS]

Options:

  • --json: Output as JSON.
  • --help: Show this message and exit.

View the members of the current Workspace.

Usage:

modal workspace members [OPTIONS] COMMAND [ARGS]...

Options:

  • --help: Show this message and exit.

Commands:

  • list: List the members of the current Workspace.

List the members of the current Workspace.

Usage:

modal workspace members list [OPTIONS]

Options:

  • --json
  • --help: Show this message and exit.

Manage the proxy tokens of the current Workspace.

Proxy tokens provide authentication to Modal Endpoints, Servers, and Web Functions.

Proxy tokens and secrets have wk- and ws- prefixes, respectively. They cannot be interchanged with API tokens (which use ak- and as- prefixes).

Proxy tokens are passed as request headers, either as a key / secret pair:

Modal-Key: wk-123
Modal-Secret: ws-456

Or as a single Bearer token:

Authorization: Bearer wk-123.ws-456

See https://modal.com/docs/guide/webhook-proxy-auth for more information.

On workspaces with RBAC enabled, tokens are scoped to specific environments; use the allow and revoke commands to manage environment associations.

Usage:

modal workspace proxy-tokens [OPTIONS] COMMAND [ARGS]...

Options:

  • --help: Show this message and exit.

Commands:

  • allow: Allow a proxy token to authenticate to an environment.
  • create: Create a proxy token in the current Workspace.
  • delete: Delete a proxy token from the current Workspace.
  • list: List the proxy tokens of the current Workspace.
  • revoke: Revoke a proxy token's access to an environment.
  • update: Update a proxy token in the current Workspace.

Allow a proxy token to authenticate to an environment.

Example:

modal workspace proxy-tokens allow wk-123 prod

Usage:

modal workspace proxy-tokens allow [OPTIONS] TOKEN_ID ENVIRONMENT_NAME

Options:

  • --help: Show this message and exit.

Create a proxy token in the current Workspace.

The new token's ID and secret will be printed to stdout. The secret is only shown at creation time and cannot be retrieved later.

Examples:

modal workspace proxy-tokens create --name production-webhooks
modal workspace proxy-tokens create --json

Usage:

modal workspace proxy-tokens create [OPTIONS]

Options:

  • --name TEXT: Name to help identify the token.
  • --json
  • --help: Show this message and exit.

Delete a proxy token from the current Workspace.

Example:

modal workspace proxy-tokens delete wk-123

Usage:

modal workspace proxy-tokens delete [OPTIONS] TOKEN_ID

Options:

  • -y, --yes: Run without pausing for confirmation.
  • --help: Show this message and exit.

List the proxy tokens of the current Workspace.

Examples:

modal workspace proxy-tokens list
modal workspace proxy-tokens list --environment prod
modal workspace proxy-tokens list --json

Usage:

modal workspace proxy-tokens list [OPTIONS]

Options:

  • -e, --environment TEXT: Only list tokens associated with this environment. Lists all tokens when omitted.
  • --json
  • --help: Show this message and exit.

Revoke a proxy token's access to an environment.

Example:

modal workspace proxy-tokens revoke wk-123 prod

Usage:

modal workspace proxy-tokens revoke [OPTIONS] TOKEN_ID ENVIRONMENT_NAME

Options:

  • --help: Show this message and exit.

Update a proxy token in the current Workspace.

The following settings can be updated:

  • name: A name to help identify the token. Pass an empty value to remove it.

Example:

modal workspace proxy-tokens update wk-123 name production-webhooks

Usage:

modal workspace proxy-tokens update [OPTIONS] TOKEN_ID SETTING VALUE

Options:

  • --help: Show this message and exit.

Manage Service Users. Must be workspace manager or owner.

Service users are programmatic accounts that allow automated systems to interact with Modal. They're ideal for CI/CD pipelines, automated deployments, and other workflows that need to authenticate.

Service User credentials are typically made available to a process as environment variables:

export MODAL_TOKEN_ID=your-token-id
export MODAL_TOKEN_SECRET=your-token-secret

A newly created Service User has no permissions by default. In order to interact with a specific Environment, Service Users must be granted explicit permissions.

See https://modal.com/docs/guide/service-users for more information.

Usage:

modal workspace service-users [OPTIONS] COMMAND [ARGS]...

Options:

  • --help: Show this message and exit.

Commands:

  • create: Create a Service User in this workspace.
  • delete: Delete a Service User in this Workspace.
  • info: Inspect a Service User in this workspace.
  • list: List all Service Users in this workspace.
  • set-role: Update a Service User's role in a specific Environment.

Create a Service User in this workspace.

In order to run this command, you must have at least Manager level permissions in the Workspace.

By default, Service Users have no permissions. To explicitly grant the Service User permissions to interact with a given environment, use modal workspace service-users set-role or modal environment roles update.

Optionally, you can also specify an expiration window by passing --expires-in. After the specified amount of time elapses, this Service User will be deleted, and any credentials associated with this Service User will stop working. The option expects a positive integer value, optionally suffixed by the units s, m, h, or d, meaning seconds, minutes, hours, and days respectively. If no suffix is provided, the value is interpreted as seconds. If --expires-in is not provided, the newly created Service User will never expire.

Examples:

# Create a Service User named `test-1`, which never expires:
modal workspace service-users create test-1

# Two ways of creating a Service User which is valid for an hour:
modal workspace service-users create test-2 --expires-in 3600
modal workspace service-users create test-3 --expires-in 1h

# Create a Service User which is valid for 1 year, outputting JSON:
modal workspace service-users create test-4 --expires-in 365d --json

Usage:

modal workspace service-users create [OPTIONS] NAME

Options:

  • --expires-in TEXT: Expiration time. Accepts integers (interpreted as seconds), as well as values suffixed by s, m, h, or d.
  • --json: Output as JSON.
  • --help: Show this message and exit.

Delete a Service User in this Workspace.

Note that this action is irreversible. Any existing processes / scripts that use the credentials associated with the target Service User will stop being able to authenticate with Modal.

# Delete the Service User named `test-service-user`
modal workspace service-users delete test-service-user

Usage:

modal workspace service-users delete [OPTIONS] NAME

Options:

  • --allow-missing: Don't error if the Service User doesn't exist.
  • -y, --yes: Run without pausing for confirmation.
  • --help: Show this message and exit.

Inspect a Service User in this workspace.

Examples:

# Inspect the Service User named `test-service-user`
modal workspace service-users info test-service-user

# Inspect the Service User named `test-service-user-2`, outputting JSON
modal workspace service-users info test-service-user-2 --json

Usage:

modal workspace service-users info [OPTIONS] NAME

Options:

  • --json: Output as JSON.
  • --help: Show this message and exit.

List all Service Users in this workspace.

In order to run this command, you must have at least Manager level permissions in the Workspace.

Examples:

# List all Service Users with a human-readable output format
modal workspace service-users list

# List all Service Users and return JSON output
modal workspace service-users list --json

Usage:

modal workspace service-users list [OPTIONS]

Options:

  • --json: Output as JSON.
  • --help: Show this message and exit.

Update a Service User's role in a specific Environment.

Examples:

# Give Contributor access in Environment `main` to Service User `test-service-user`
modal workspace service-users set-role test-service-user main contributor

# Revoke access to Environment `prod` from Service User `test-service-user`
modal workspace service-users set-role test-service-user prod no-access

Usage:

modal workspace service-users set-role [OPTIONS] SERVICE_USER_NAME ENVIRONMENT_NAME ROLE

Options:

  • --help: Show this message and exit.

Manage workspace settings. Must be workspace manager or owner.

Usage:

modal workspace settings [OPTIONS] COMMAND [ARGS]...

Options:

  • --help: Show this message and exit.

Commands:

  • list: View the current settings for the workspace.
  • set: Update a workspace setting.

View the current settings for the workspace.

Usage:

modal workspace settings list [OPTIONS]

Options:

  • --json
  • --help: Show this message and exit.

Update a workspace setting. Must be workspace manager or owner.

The following settings can be updated:

  • image-builder-version: The image builder version determines the software included in our base images.
  • default-environment: The default environment to use when the environment is omitted from SDK or CLI methods.

Usage:

  • modal workspace settings set image-builder-version 2025.06
  • modal workspace settings set default-environment main

Usage:

modal workspace settings set [OPTIONS] SETTING VALUE

Options:

  • --help: Show this message and exit.